Claude/hostile code audit rbz3f8

[smj1860]

Summary by CodeRabbit

• New Features

  • Added smart PAR calculation modes for more adaptive inventory replenishment.
  • Added configurable item groups, base quantities, automatic adjustments, and resolution timestamps.
  • Added consumption tracking to support historical inventory-based recommendations.
  • Preserved static PAR settings and added validation for submitted configurations.

• Documentation

  • Added implementation and migration status documentation for the Dynamic PAR Engine.

• Tests

  • Added coverage for static and smart calculations, historical adjustments, thresholds, safeguards, and invalid configurations.

[greptile-apps]

smj1860 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fieldstay	Ready	Preview	Aug 11, 2026 2:41am

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds the Dynamic PAR Engine schema, a synchronous resolution engine, configuration normalization, type models, tests, migration safeguards, port-state documentation, and global Supabase error-handling checks.

Changes

Dynamic PAR engine

Layer / File(s)	Summary
PAR schema and migration safeguards supabase/migrations/*.sql, scripts/check-db-invariants.mjs	Adds PAR modes, smart groups, configuration fields, consumption statistics, validation constraints, RLS policies, junction-table detection, and the corrected stats-table relationship.
PAR types and resolution types/database.ts, lib/inventory/par-engine.ts, scripts/check-type-drift.mjs	Adds PAR types, smart-group formulas, historical resolution, static-mode handling, configuration normalization, and enum drift mappings.
Resolution validation unit/inventory/par-engine.test.ts	Tests static, smart, historical, fallback, normalization, and invalid-configuration behavior.
Port-state and future remediation docs/PAR_ENGINE_PORT_STATE.md, FUTURE_REMEDIATION.md	Documents the port state, migration sequence, formulas, seed mapping, design gaps, owner decisions, implementation order, and deferred variance-based remediation.

Supabase repository guardrails

Layer / File(s)	Summary
Global Supabase error checks .semgrep/chokepoints.yml, .semgrep/ratchet.yml, .semgrep/baseline-counts.json	Promotes three Supabase result and error-handling rules to ERROR-level whole-tree checks and removes their ratchet entries.
Guardrail documentation and history .semgrep/README.md, CLAUDE.md	Records rule promotions, finding reductions, validation results, schema guardrails, and the remaining ratchet scope.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• smj1860/fieldstay#508: Shares updates to type-drift checking and database type definitions.
• smj1860/fieldstay#544: Shares Semgrep baseline and Supabase error-handling enforcement changes.
• smj1860/fieldstay#545: Shares updates to Semgrep guardrail configuration and documentation.

Suggested reviewers: claude

Sequence Diagram(s)

sequenceDiagram
  participant InventoryItem
  participant ParEngine
  participant ConsumptionStats
  InventoryItem->>ParEngine: configuration and property context
  ConsumptionStats->>ParEngine: consumption aggregates
  ParEngine->>InventoryItem: resolved PAR value and source

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title indicates an audit but does not identify the primary changes, which include the dynamic PAR engine, schema updates, and code-quality guardrails.	Replace the audit label with a concise summary of the main changes, such as implementing the dynamic PAR engine and adding related schema and validation guardrails.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/hostile-code-audit-rbz3f8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@FUTURE_REMEDIATION.md`:
- Around line 1513-1536: Clarify the documentation before prescribing the
restock formula by defining projected guest-nights for the selected 3–4-stay
restock cycle. Express mean demand and variance over that same cycle horizon,
and explicitly state whether M2 tracks per-guest-night, per-stay, or per-cycle
demand; ensure the safety-stock calculation uses consistent demand units
throughout.

In `@supabase/migrations/20260810214329_dynamic_par_engine_schema.sql`:
- Around line 139-154: Update the RLS policy definitions for
inventory_consumption_stats after ENABLE ROW LEVEL SECURITY to add INSERT,
UPDATE, and DELETE policies alongside inventory_consumption_stats_select. Scope
each write policy with get_user_org_ids() and is_org_member(), using both USING
and WITH CHECK clauses as required; preserve the existing service_role grants
and ingestion behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8caff28f-876f-410e-8739-02241a61a741

📥 Commits

Reviewing files that changed from the base of the PR and between 05ef026 and 111c518.

📒 Files selected for processing (5)

• FUTURE_REMEDIATION.md
• docs/PAR_ENGINE_PORT_STATE.md
• lib/inventory/par-engine.ts
• supabase/migrations/20260810214329_dynamic_par_engine_schema.sql
• unit/inventory/par-engine.test.ts

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Define demand units before prescribing the restock formula.

avg_rate_per_guest_night cannot be multiplied directly by lead_time in days. The result has incompatible units. The coverage target also uses stays, not days.

Define projected guest-nights for the selected 3–4-stay restock cycle. Then calculate mean demand and variance over that same horizon. Define whether M2 tracks per-guest-night, per-stay, or per-cycle demand before implementing safety stock.

Proposed documentation correction

- par = rate x lead_time + Z x sigma x sqrt(lead_time)
+ par = rate_per_guest_night × projected_guest_nights_per_restock_cycle
+       + safety_stock_for_that_same_cycle

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	`inventory_consumption_stats` currently stores only `avg_rate_per_guest_night`
	and `sample_count`, so there is no sigma to use. Welford's online algorithm
	gets it from a running `M2` column without retaining samples — about ten lines
	and one migration adding two columns. No dependency: this is a formula, not a
	library.
	**2. A plain mean never forgets.** A count from six months ago weighs the same
	as last week's, so seasonality and a changed guest mix both wash out. An
	exponentially weighted moving average (`new = alpha*obs + (1-alpha)*old`,
	alpha ~ 0.3) tracks them and removes any reason for `sample_count` to grow
	without bound.
	**3. Par should cover a restock CYCLE, not one stay.** This is the conceptual
	one, and the product owner's call on the numbers:
	- coverage target: **3–4 stays**, not the single average stay
	`historicalPar()` assumes today
	- restock lead time: **2.5 days**, chosen to err cautious
	The classic form is `par = rate x lead_time + Z x sigma x sqrt(lead_time)`.
	FieldStay already knows lead time is real — it has purchase orders and Kroger
	cart automation — so a par that means "enough until I can restock" is
	expressible, whereas "enough for one stay" is what the formula currently
	computes.
	`inventory_consumption_stats` currently stores only `avg_rate_per_guest_night`
	and `sample_count`, so there is no sigma to use. Welford's online algorithm
	gets it from a running `M2` column without retaining samples — about ten lines
	and one migration adding two columns. No dependency: this is a formula, not a
	library.
	**2. A plain mean never forgets.** A count from six months ago weighs the same
	as last week's, so seasonality and a changed guest mix both wash out. An
	exponentially weighted moving average (`new = alpha*obs + (1-alpha)*old`,
	alpha ~ 0.3) tracks them and removes any reason for `sample_count` to grow
	without bound.
	**3. Par should cover a restock CYCLE, not one stay.** This is the conceptual
	one, and the product owner's call on the numbers:
	- coverage target: **3–4 stays**, not the single average stay
	`historicalPar()` assumes today
	- restock lead time: **2.5 days**, chosen to err cautious
	The classic form is `par = rate_per_guest_night × projected_guest_nights_per_restock_cycle
	safety_stock_for_that_same_cycle`.
	FieldStay already knows lead time is real — it has purchase orders and Kroger
	cart automation — so a par that means "enough until I can restock" is
	expressible, whereas "enough for one stay" is what the formula currently
	computes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@FUTURE_REMEDIATION.md` around lines 1513 - 1536, Clarify the documentation
before prescribing the restock formula by defining projected guest-nights for
the selected 3–4-stay restock cycle. Express mean demand and variance over that
same cycle horizon, and explicitly state whether M2 tracks per-guest-night,
per-stay, or per-cycle demand; ensure the safety-stock calculation uses
consistent demand units throughout.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Define all required RLS policies for the new table.

inventory_consumption_stats has only a SELECT policy. Add INSERT, UPDATE, and DELETE policies. Scope each policy with get_user_org_ids() and is_org_member(). Use both USING and WITH CHECK for write policies.

Retain service-role ingestion if required. Service-role access does not replace the required RLS policy set.

As per coding guidelines, “Every new table migration must enable RLS and define SELECT, INSERT, UPDATE, and DELETE policies using get_user_org_ids() and is_org_member(); use both USING and WITH CHECK for write policies.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@supabase/migrations/20260810214329_dynamic_par_engine_schema.sql` around
lines 139 - 154, Update the RLS policy definitions for
inventory_consumption_stats after ENABLE ROW LEVEL SECURITY to add INSERT,
UPDATE, and DELETE policies alongside inventory_consumption_stats_select. Scope
each write policy with get_user_org_ids() and is_org_member(), using both USING
and WITH CHECK clauses as required; preserve the existing service_role grants
and ingestion behavior.

Source: Coding guidelines

[greptile-apps]

smj1860 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

smj1860 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

smj1860 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.semgrep/chokepoints.yml:
- Around line 398-410: Expand both Supabase result-destructure rule groups at
.semgrep/chokepoints.yml lines 398-410 and 428-432 to match let and var
declarations, count-only destructuring, and aliased count bindings in addition
to current const data forms. Add corresponding error-exclusion patterns for
every new declaration shape, and ensure the expanded patterns also cover
Promise.all fan-ins; preserve the existing exclusions for destructures
containing error.

In `@supabase/migrations/20260811020000_fix_par_stats_junction_ambiguity.sql`:
- Around line 46-50: Update the primary-key creation block around
inventory_consumption_stats_pkey to stop swallowing invalid_table_definition
errors. Let ADD CONSTRAINT fail when the existing primary key has an unexpected
shape, or explicitly inspect and validate the existing constraint before
proceeding; do not treat the failed creation as successful.

In `@types/database.ts`:
- Around line 655-668: Update the InventoryConsumptionStats table documentation
by removing the obsolete description that claims rows are keyed by (property,
item) and use a composite primary key. Retain the explanation that
inventory_item_id is the sole primary key and property_id is intentionally
absent.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2582a2fa-57a9-4366-9673-0cbfe7ddf142

📥 Commits

Reviewing files that changed from the base of the PR and between 111c518 and a6e2c9a.

⛔ Files ignored due to path filters (1)

• types/database.generated.ts is excluded by !**/*.generated.*

📒 Files selected for processing (11)

• .semgrep/README.md
• .semgrep/baseline-counts.json
• .semgrep/chokepoints.yml
• .semgrep/ratchet.yml
• CLAUDE.md
• docs/PAR_ENGINE_PORT_STATE.md
• lib/inventory/par-engine.ts
• scripts/check-db-invariants.mjs
• scripts/check-type-drift.mjs
• supabase/migrations/20260811020000_fix_par_stats_junction_ambiguity.sql
• types/database.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• lib/inventory/par-engine.ts

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

cat > "$tmpdir/supabase-error-handling-fixture.ts" <<'EOF'
async function verifyCoverage() {
  let { data } = await supabase.from('items').select()
  const { count } = await supabase.from('items').select('*', { count: 'exact' })

  let [{ data: batchData }] = await Promise.all([
    supabase.from('items').select(),
  ])
  const [{ count: batchCount }] = await Promise.all([
    supabase.from('items').select('*', { count: 'exact' }),
  ])

  let { data: handledData, error: handledError } = await supabase.from('items').select()
  const [{ count: handledCount, error: handledBatchError }] = await Promise.all([
    supabase.from('items').select('*', { count: 'exact' }),
  ])
}
EOF

semgrep --config .semgrep/chokepoints.yml --json "$tmpdir" |
  jq '[.results[] | select(
    .check_id == "fieldstay-supabase-read-without-error" or
    .check_id == "fieldstay-supabase-read-without-error-fan-in"
  )] | length'

# Expect 4 findings after the rule expansion and zero findings for the handled controls.

Repository: smj1860/fieldstay

Length of output: 605

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- relevant rules ---'
sed -n '360,455p' .semgrep/chokepoints.yml

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

cat > "$tmpdir/supabase-error-handling-fixture.ts" <<'EOF'
async function verifyCoverage() {
  let { data } = await supabase.from('items').select()
  var { data: aliasedData } = await supabase.from('items').select()
  const { count } = await supabase.from('items').select('*', { count: 'exact' })
  let { count: aliasedCount } = await supabase.from('items').select('*', { count: 'exact' })

  let [{ data: batchData }] = await Promise.all([
    supabase.from('items').select(),
  ])
  var [{ data: varBatchData }] = await Promise.all([
    supabase.from('items').select(),
  ])
  const [{ count: batchCount }] = await Promise.all([
    supabase.from('items').select('*', { count: 'exact' }),
  ])
  let [{ count: letBatchCount }] = await Promise.all([
    supabase.from('items').select('*', { count: 'exact' }),
  ])

  let { data: handledData, error: handledError } = await supabase.from('items').select()
  const [{ count: handledCount, error: handledBatchError }] = await Promise.all([
    supabase.from('items').select('*', { count: 'exact' }),
  ])
}
EOF

semgrep --config .semgrep/chokepoints.yml --json "$tmpdir" > "$tmpdir/results.json"
jq '[.results[] | {check_id, path, start: .start.line, lines: .extra.lines}]' "$tmpdir/results.json"

Repository: smj1860/fieldstay

Length of output: 6459

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

cat > "$tmpdir/supabase-error-handling-fixture.ts" <<'EOF'
async function verifyCoverage() {
  let { data } = await supabase.from('items').select()
  var { data: aliasedData } = await supabase.from('items').select()
  const { count } = await supabase.from('items').select('*', { count: 'exact' })
  let { count: aliasedCount } = await supabase.from('items').select('*', { count: 'exact' })

  let [{ data: batchData }] = await Promise.all([
    supabase.from('items').select(),
  ])
  var [{ data: varBatchData }] = await Promise.all([
    supabase.from('items').select(),
  ])
  const [{ count: batchCount }] = await Promise.all([
    supabase.from('items').select('*', { count: 'exact' }),
  ])
  let [{ count: letBatchCount }] = await Promise.all([
    supabase.from('items').select('*', { count: 'exact' }),
  ])

  let { data: handledData, error: handledError } = await supabase.from('items').select()
  const [{ count: handledCount, error: handledBatchError }] = await Promise.all([
    supabase.from('items').select('*', { count: 'exact' }),
  ])
}
EOF

printf '%s\n' '--- rules ---'
sed -n '360,455p' .semgrep/chokepoints.yml

printf '%s\n' '--- all findings ---'
semgrep --config .semgrep/chokepoints.yml --json "$tmpdir" |
  jq '[.results[] | {check_id, path, start_line: .start.line, matched: .extra.lines}]'

Repository: smj1860/fieldstay

Length of output: 6540

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT

cat > "$tmpdir/fixture.ts" <<'EOF'
async function verifyCoverage() {
  const { data } = await supabase.from('items').select()
  const { data: aliasedData } = await supabase.from('items').select()
  let { data: letData } = await supabase.from('items').select()
  var { count: varCount } = await supabase.from('items').select()

  const [{ data: batchData }] = await Promise.all([
    supabase.from('items').select(),
  ])
  let [{ data: letBatchData }] = await Promise.all([
    supabase.from('items').select(),
  ])
  var [{ count: batchCount }] = await Promise.all([
    supabase.from('items').select(),
  ])

  const { data: handledData, error: handledError } =
    await supabase.from('items').select()
  const [{ count: handledCount, error: handledBatchError }] =
    await Promise.all([supabase.from('items').select()])
}
EOF

cat > "$tmpdir/direct.yml" <<'EOF'
rules:
  - id: single
    languages: [typescript]
    message: single
    severity: ERROR
    patterns:
      - pattern-either:
          - pattern: "const { data } = await $Q"
          - pattern: "const { data: $D } = await $Q"
          - pattern: "const { data, count: $C } = await $Q"
          - pattern: "const { data: $D, count: $C } = await $Q"
      - pattern-not: "const {..., error, ...} = await $Q"
      - pattern-not: "const {..., error: $E, ...} = await $Q"
      - metavariable-pattern:
          metavariable: $Q
          pattern: <... $S.from($T) ...>
  - id: fanin
    languages: [typescript]
    message: fanin
    severity: ERROR
    patterns:
      - pattern-either:
          - pattern: "const [..., { data: $D }, ...] = await Promise.all(...)"
          - pattern: "const [..., { data }, ...] = await Promise.all(...)"
      - pattern-not: "const [..., {..., error, ...}, ...] = await Promise.all(...)"
      - pattern-not: "const [..., {..., error: $E, ...}, ...] = await Promise.all(...)"
EOF

semgrep --config "$tmpdir/direct.yml" --json "$tmpdir/fixture.ts" |
  jq '[.results[] | {check_id, start_line: .start.line, matched: .extra.lines}]'

Repository: smj1860/fieldstay

Length of output: 922

---

Expand both Supabase result-destructure rules.

The current rules report const data bindings but miss let and var, count-only bindings, and count aliases. Add matching patterns and error exclusions for these forms in both rules, including Promise.all fan-ins.

📍 Affects 1 file

• .semgrep/chokepoints.yml#L398-L410 (this comment)
• .semgrep/chokepoints.yml#L428-L432

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.semgrep/chokepoints.yml around lines 398 - 410, Expand both Supabase
result-destructure rule groups at .semgrep/chokepoints.yml lines 398-410 and
428-432 to match let and var declarations, count-only destructuring, and aliased
count bindings in addition to current const data forms. Add corresponding
error-exclusion patterns for every new declaration shape, and ensure the
expanded patterns also cover Promise.all fan-ins; preserve the existing
exclusions for destructures containing error.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

: "${DATABASE_URL:?Set DATABASE_URL to a staging database URL}"
psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -c "
  SELECT conname, pg_get_constraintdef(oid)
  FROM pg_constraint
  WHERE conrelid = 'public.inventory_consumption_stats'::regclass
    AND contype = 'p';
"

Repository: smj1860/fieldstay

Length of output: 226

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file="supabase/migrations/20260811020000_fix_par_stats_junction_ambiguity.sql"
printf '%s\n' '--- migration ---'
cat -n "$file"

printf '%s\n' '--- references to inventory_consumption_stats ---'
rg -n --hidden -g '!node_modules' -g '!dist' -g '!build' \
  'inventory_consumption_stats|property_id' .

printf '%s\n' '--- related migration files ---'
git ls-files 'supabase/migrations/**/*.sql' | tail -n 30

Repository: smj1860/fieldstay

Length of output: 50374

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- handwritten inventory stats type ---'
sed -n '645,690p' types/database.ts

printf '%s\n' '--- generated inventory stats type ---'
sed -n '1825,1905p' types/database.generated.ts

printf '%s\n' '--- schema reference inventory stats ---'
rg -n -A45 -B8 'inventory_consumption_stats' supabase/schema_reference.sql

printf '%s\n' '--- exact table/column consumers ---'
rg -n --hidden -g '!node_modules' -g '!dist' -g '!build' \
  'inventory_consumption_stats(\.|\b)|inventory_consumption_stats_' \
  app components lib scripts unit e2e supabase types 2>/dev/null || true

printf '%s\n' '--- migrations defining or altering the table ---'
rg -n -A45 -B10 \
  'CREATE TABLE[^;]*inventory_consumption_stats|ALTER TABLE[^;]*inventory_consumption_stats' \
  supabase/migrations supabase/schema_reference.sql

Repository: smj1860/fieldstay

Length of output: 4423

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- migrations mentioning the table ---'
rg -l --hidden -g '*.sql' 'inventory_consumption_stats' supabase/migrations supabase/schema_reference.sql \
  | sort

printf '%s\n' '--- table definition and constraints in matching migrations ---'
for file in $(rg -l --hidden -g '*.sql' 'inventory_consumption_stats' supabase/migrations supabase/schema_reference.sql | sort); do
  printf '\n--- %s ---\n' "$file"
  rg -n -A55 -B12 'inventory_consumption_stats' "$file"
done

printf '%s\n' '--- invariant checks for the table ---'
sed -n '175,230p' scripts/check-db-invariants.mjs

printf '%s\n' '--- relevant migration/type file status ---'
git status --short -- supabase/migrations/20260811020000_fix_par_stats_junction_ambiguity.sql types/database.ts types/database.generated.ts

Repository: smj1860/fieldstay

Length of output: 11908

---

Do not suppress primary-key creation errors.

If a differently named primary key already exists, ADD CONSTRAINT can raise invalid_table_definition. The handler then reports success while retaining the unexpected key shape. Let the migration fail or validate the existing constraint explicitly.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@supabase/migrations/20260811020000_fix_par_stats_junction_ambiguity.sql`
around lines 46 - 50, Update the primary-key creation block around
inventory_consumption_stats_pkey to stop swallowing invalid_table_definition
errors. Let ADD CONSTRAINT fail when the existing primary key has an unexpected
shape, or explicitly inspect and validate the existing constraint before
proceeding; do not treat the failed creation as successful.

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Correct the InventoryConsumptionStats table-grain documentation.

Lines 655-662 still state that the table has one row per (property, item) and a composite primary key. Lines 663-668 correctly state that inventory_item_id is the only key. Remove the obsolete description so later callers do not assume that property_id exists.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@types/database.ts` around lines 655 - 668, Update the
InventoryConsumptionStats table documentation by removing the obsolete
description that claims rows are keyed by (property, item) and use a composite
primary key. Retain the explanation that inventory_item_id is the sole primary
key and property_id is intentionally absent.